- Freeradius-Users - lists.freeradius.org

postproxy breaks eap authentication
by hans.bornemann＠tu-dortmund.de 17 Nov '10

17 Nov '10

Hi, I have 2 freeradius server: 1 as proxy server, 1 as authentication server. Everything is working fine (Auth. for WPA2, MSCHAPv2 ) until I implement the postproxy function: Then the authentication process did not finished. Putting the vlanid etc into radreply on the authentication radius, everything is working also. Is there something wrong in my config? Version: freeradius/lucid uptodate 2.1.8+dfsg-1ubuntu1 /etc/freeradius/sites-enabled/default: .... post-proxy { post_proxy_log #attr_rewrite attr_filter.post-proxy eap # Post-Proxy-Type Fail { # detail # } /etc/freeradius/attrs: tu-dortmund.de Tunnel-Private-Group-ID :=8, Fall-Through = Yes DEFAULT Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802 Regards hans -- Hans Bornemann IT & Medien Centrum - TU Dortmund Tel. 0049 231 7552132

4 6

rlm_exec and 'No such file or directory' error
by mark.leese＠stfc.ac.uk 17 Nov '10

17 Nov '10

Hi, I'm using FreeRADIUS 2.1.3. At the end of the authorize section I need to call a Perl script to do some LDAP checking and either set the Auth-Type to Reject (to forcibly reject a user) or leave it set to whatever value FreeRADIUS has previously set (always LDAP). I used to do this with rlm_perl but it looks like backslashes in the plaintext User-Password attribute causes things to break, and I need a quick fix while I look at what to do about the rlm_perl problem. I have the exec module enabled in the instantiate section of radiusd.conf and I have the following at the end of the authorize section in the sites-enabled/default file: if (control:Auth-Type == LDAP) { update control { Auth-Type = `%{exec:/etc/raddb/facilityUsers.pl %{control:Ldap-UserDn} %{control:Auth-Type}}` } } When I run the basic test with debug (-X) turned on I see the following trace: [snip] radiusd: #### Instantiating modules #### Wed Nov 17 17:36:20 2010 : Debug: instantiate { Wed Nov 17 17:36:20 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Wed Nov 17 17:36:20 2010 : Debug: Module: Linked to module rlm_exec Wed Nov 17 17:36:20 2010 : Debug: Module: Instantiating exec Wed Nov 17 17:36:20 2010 : Debug: exec { Wed Nov 17 17:36:20 2010 : Debug: wait = yes Wed Nov 17 17:36:20 2010 : Debug: input_pairs = "request" Wed Nov 17 17:36:20 2010 : Debug: shell_escape = no Wed Nov 17 17:36:20 2010 : Debug: } [snip] Wed Nov 17 17:49:21 2010 : Info: ++? if (control:Auth-Type == LDAP) Wed Nov 17 17:49:21 2010 : Info: ? Evaluating (control:Auth-Type == LDAP) -> TRUE Wed Nov 17 17:49:21 2010 : Info: ++? if (control:Auth-Type == LDAP) -> TRUE Wed Nov 17 17:49:21 2010 : Info: ++- entering if (control:Auth-Type == LDAP) {...} Wed Nov 17 17:49:21 2010 : Info: Executing /etc/raddb/facilityUsers.pl %{control:Ldap-UserDn} %{control:Auth-Type} Wed Nov 17 17:49:21 2010 : Info: expand: %{control:Ldap-UserDn} -> CN=bill,OU=Facility Users,DC=foo,DC=ac,DC=uk Wed Nov 17 17:49:21 2010 : Info: expand: %{control:Auth-Type} -> LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program output: LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program-Wait: plaintext: LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program: returned: 0 Wed Nov 17 17:49:21 2010 : Info: result 0 Wed Nov 17 17:49:21 2010 : Info: expand: %{exec:/etc/raddb/facilityUsers.pl %{control:Ldap-UserDn} %{control:Auth-Type}} -> LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program output: Wed Nov 17 17:49:21 2010 : Error: Exec-Program: FAILED to execute LDAP: No such file or directory Wed Nov 17 17:49:21 2010 : Debug: Exec-Program-Wait: plaintext: Wed Nov 17 17:49:21 2010 : Error: Exec-Program: FAILED to execute LDAP: No such file or directory Wed Nov 17 17:49:21 2010 : Debug: Exec-Program: returned: 1 Wed Nov 17 17:49:21 2010 : Info: +++[control] returns invalid Wed Nov 17 17:49:21 2010 : Info: ++- if (control:Auth-Type == LDAP) returns invalid Wed Nov 17 17:49:21 2010 : Auth: Invalid user: [bill] (from client localNas port 52340 cli AB-CD-EF-00-00-00) In this case the call to the Perl script (facilityUsers.pl) returns LDAP, but it looks like rlm_exec then tries to execute this result as a command, which fails and then the whole Access-Request message is rejected. I'm clearly doing something wrong, but I can't see what. Can anyone offer any suggestions? Thanks in advance, Mark. -- Scanned by iCritical.

2 1

Settign up postauth to record radius-client name and other information
by William 17 Nov '10

17 Nov '10

Greetings, I am trying to figure out how to record the full Auth information into the postauth table in SQL... here is the /var/log/radius/radius.log output: Thu Nov 16 15:06:07 2010 : Auth: Login OK: [testuser/kikikat] (from client Local2 port 21) Thu Nov 16 15:10:00 2010 : Auth: Login incorrect (rlm_pap: CRYPT password check failed): [testuser/kikikat2] (from client Local2 port 1) What I want to store int he radpostauth table is: (These are already working) Date/time, Username, Password, reply(accept/reject), (I want to add these) Calling_Station, Called_Station, NAS_Short_name from clients.conf What %{Attributes} would I use for these? Wm

2 1

Execute PRISM into HOSTAPD?
by Octavio Ramirez 17 Nov '10

17 Nov '10

Hello, I am working with ubuntu 9.10, I installed freeradius server 2.1.10, Radius server is ok, but I am trying to implement "hostapd" in order to have a management of several access points. Thus, I installed the "hostapd" program, but I have a question concerning with other software related to hostapd. I downloaded PRISM by using the "update manager" utility provided by Ubuntu. How can I execute PRISM by using a terminal? Which are the commands to execute PRISM? Do you have a "quick install" document to install PRISM? Thanks in advance. Octavio Ramírez Rojas

1 0

EAP-SIM and EAP-AKA support
by dfds fds 17 Nov '10

17 Nov '10

From: dfds fds <srinujob2004(a)yahoo.com> Subject: EAP-SIM and EAP-AKA support To: freeradius-users(a)lists.freeradius.org, freeradius-devel(a)lists.freeradius.org Date: Wednesday, November 3, 2010, 6:47 PM Hi, I am trying to setup a radius server with EAP-SIM and EAP-AKA supportIt seems to be freeradius server supports EAP-SIM but i am not sure about AKA , is freeradius supports EAP-AKA also. Could you please fwd procedure to setup freeradius server with EAP-SIM and AKA support. is there is any freely available servers , which supports these features? Thanks for your help RegardsSrinivas

3 3

Logging ntlm authentication
by Sion 17 Nov '10

17 Nov '10

Hi, I've got freeradius 2.1.7 setup on a CentOS system working as an AAA server for our WPA Enterprise based wireless network with clients successfully authenticating using PEAP and TTLS. Now to my question, I've configured linelog to log certain attributes but I also want it to log either the Exec-Program output of ntlm_auth or the peap reply value for the MS-CHAP-Error attribute but so far I've been unsuccessful in doing this. Is this possible? if so can anybody give me any pointers? Regards, Sion

6 34

Differences between FreeRadius and GNU Radius
by den2k 17 Nov '10

17 Nov '10

Hi, I'm new to RADIUS and I have to configure a rather complex system. Due to the lack of (well made) documentation on the wiki I googled around and I've found a good manual for GNU Radius (the old radiusd). So my question is: how much can I rely on that documentation while writing configuration files for FreeRADIUS? Does exist some piece of documentation which lists the differences between the two systems? I'm especially interested in the 'huntsgroup' file and in the authentication protocols Thank you for interesting, Denis -- \ __ __ _ * _\ \__\ \ \ _\ \/ \_\ \__ \ \ \__ \\ -------------------------> Registered Linux User # 372295 -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/CM d--- s:+: a-- C+++ UL+++S E--- W+(-) N o+ w--- O? M-- PS+ PE Y+ PGP t+(++) 5? X- R* tv-- b+ DI+ D++++ G+ e h! r++ y* ------END GEEK CODE BLOCK------

2 1

Having two MS-MPPE key pairs...
by Panagiotis Georgopoulos 17 Nov '10

17 Nov '10

Hello all, I am using EAP-TTLS/EAP-MSCHAPv2 to authenticate clients with a FR 2.1.10 backend AAA server. Requests go over an Access Point (playing the role of the NAS), then get forwarded to a Proxy AAA FR 2.1.10 server and finally get routed to my backend server. My client is using wpa_supplicant with "EAP=TTLS" and "Phase2="autheap=mschapv2"" options in the configuration file. The problem I am having is that when the FR sends the final Accept-Accept to the client, I end up having two MS-MPPE-Send-Key and MS-MPPE-Recv-Key keys of different length, one added by the mschap module and one added by the eap module, as seen here : Sending Access-Accept of id 52 to 2001:db95::100 port 1814 Reply-Message = "Hello, bob-mr1" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x8566119a6066e8eb7c1663dea8d1629b MS-MPPE-Recv-Key = 0xc1f99bac753248c48db73fd5585bf810 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "bob-mr1" MS-MPPE-Recv-Key = 0x2eb89da2ac20179cb2b99391f94ca2bddf1701c67c524badad98ce56f09873dc MS-MPPE-Send-Key = 0x0cf013411cfcea14ae9dee56baaf5467e55caed80fa83ffbbdf0f5998ce7fe62 EAP-Message = 0x03cf0004 Proxy-State = 0x3130 (if someone wants a full debug output of the server it is posted here : http://pastebin.com/aXFMXXbT ) Having two MS-MPPE key pairs is wrong and does not allow the end-client to properly finish its key exchange with the Access Point, but restarts the EAP-TTLS communication. I figured out that I could remove one pair of keys, by either doing this at the end of my post-auth section of my inner-tunnel : update reply { MS-MPPE-Send-Key !* 0x00 MS-MPPE-Recv-Key !* 0x00 } ..or if I set "use_mppe=no" to the mschap module although this means that I will be loosing the MS-MPPE-Encryption-Policy and MS-MPPE-Encryption-Types attributes as well. Which one do you think is the best approach and has less impact for other authentication methods (e.g. straightforward mschapv2 or others)? By the way, I also tried using PEAP and mschapv2 for phase 2 but it didn't have the above problem (it had just one pair of MS-MPPE keys). Isn't that weird since mschapv2 in PEAP is also eap-mschapv2 so it would expect to get exactly the same phase 2 with EAP-TTLS.. What am I missing here? Thanks a lot in advance, Panos

1 0

How to block user to authenticate over ldap
by eduardo moreira 16 Nov '10

16 Nov '10

Hi, With help of list i make my freeradius + ldap, now works. But now i have other doubt, how to disable one user to authenticate in freeradius? Remember, i dont block user to log in ldap, but block user to use freeradius. Thank for help.

2 1

Chargeable-User-Identity implementation
by Stefan Winter 16 Nov '10

16 Nov '10

Hello, since quite a while, there's an implementation of Chargeable-User-Identity in the works by people of eduroam R&D (inside the GEANT3 project). Attached is the most recent implementation. We hope that it is worthy of inclusion into the mainline release now: it's a small set of new files (modules/cui, SQL schema definitions) and a few stand-in replacements that augment some shipped files (policy.conf, sites-available/*). Please take a look and comment. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 5